Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes

Paper: 2602.22197 Authors: Xavier Pleimling, Sifat Muhammad Abdullah, Gunjan Balde, Peng Gao, Mainack Mondal, Murtuza Jadliwala, Bimal Viswanath Categories: cs.CV, cs.AI

Abstract

This paper exposes a fundamental weakness in current image protection schemes designed to prevent unauthorized use by generative AI systems. The authors demonstrate that off-the-shelf image-to-image models can be trivially repurposed as generic “denoisers” to remove protective perturbations added to images. Through 8 comprehensive case studies covering 6 different protection mechanisms—including anti-style mimicry, anti-deepfake, and adversarial perturbation schemes—the research shows that a simple text prompt approach not only defeats these protections but often outperforms specialized attacks. This finding suggests that many existing protection methods provide only a false sense of security and highlights the urgent need for more robust defense mechanisms that can withstand attacks from readily available GenAI tools.

Key Contributions

• Demonstrates that off-the-shelf image-to-image GenAI models can serve as universal attack vectors against image protection schemes without requiring specialized training or adaptation
• Evaluates the attack across 6 diverse protection mechanisms spanning multiple threat models, including Glaze, Mist, PhotoGuard, Anti-DreamBooth, and adversarial perturbations
• Shows that the generic denoising approach outperforms existing purpose-built attacks while maintaining high image utility for adversarial purposes
• Provides empirical evidence that current protection schemes are fundamentally vulnerable to a class of attacks that require minimal technical sophistication
• Establishes a new baseline requirement that future protection mechanisms must be benchmarked against off-the-shelf GenAI model attacks

Methodology and Attack Framework

The core insight of this work is deceptively simple yet powerful: image-to-image models trained for general-purpose tasks can be repurposed to remove protective perturbations by treating them as “noise.” The attack framework operates through a straightforward prompting strategy where the protected image is fed into models like Stable Diffusion or similar architectures with prompts designed to preserve content while removing artifacts.

The researchers tested their approach across multiple dimensions:

Protection Schemes Evaluated: The study examined anti-style mimicry tools (Glaze, Mist), anti-deepfake protections (PhotoGuard), anti-personalization defenses (Anti-DreamBooth), and general adversarial perturbations designed to fool classifiers or detectors.

Attack Configuration: Rather than requiring model fine-tuning or specialized architectures, the attack uses standard inference with carefully crafted prompts. The prompts typically instruct the model to “denoise,” “clean,” or “enhance” the image, leveraging the model’s inherent capability to distinguish between semantic content and noise-like perturbations.

Evaluation Metrics: Success was measured through multiple lenses—the ability to enable the originally-blocked misuse (e.g., successful style mimicry after protection removal), perceptual quality metrics (LPIPS, SSIM), and task-specific performance indicators depending on the protection scheme being attacked.

Experimental Results and Analysis

The experimental results reveal a concerning pattern across all tested protection schemes. In every case study, the off-the-shelf image-to-image approach successfully circumvented the protection with high effectiveness:

Against Style Mimicry Protection: For tools like Glaze and Mist that add perturbations to prevent AI from learning an artist’s style, the denoising attack restored sufficient style information to enable successful mimicry. The protected images, when processed through the attack, allowed style transfer models to capture artistic characteristics that were previously obscured.

Against Deepfake Protection: PhotoGuard and similar schemes that aim to disrupt facial manipulation were effectively neutralized. The attack removed protective perturbations while preserving facial features necessary for deepfake generation, enabling the very manipulations the protection was designed to prevent.

Against Personalization Defenses: Anti-DreamBooth protections, which prevent personalized model training on protected images, were bypassed with the cleaned images successfully used for personalization tasks.

Comparative Performance: Notably, the generic attack often matched or exceeded the performance of specialized attacks designed specifically for each protection scheme. This suggests that the vulnerability is not merely theoretical but represents a practical and accessible threat.

The preservation of image utility is particularly significant—the attack maintains perceptual quality and semantic content while removing protections, meaning adversaries can achieve their malicious goals without significant degradation in output quality.

Security Implications and Future Directions

This research fundamentally challenges the current paradigm of image protection. The findings suggest that the “arms race” between protection and attack methods has reached a critical juncture where the accessibility of powerful GenAI tools has shifted the advantage decisively toward attackers.

The False Security Problem: Many users and content creators rely on these protection schemes believing their images are safeguarded. This work demonstrates that such confidence may be misplaced, as the barrier to breaking these protections has been lowered to simply using publicly available tools with basic prompts.

Implications for Defense Design: The results indicate that protection mechanisms must be designed with the assumption that adversaries have access to state-of-the-art image-to-image models. Defenses that rely solely on adding imperceptible perturbations may be inherently vulnerable to this class of attacks.

The Robustness Gap: There exists a fundamental tension between making perturbations imperceptible (to maintain image quality) and making them robust enough to survive denoising by powerful generative models. Current schemes appear to fall on the wrong side of this trade-off.

Future Research Directions: The authors advocate for exploring alternative protection paradigms that don’t rely solely on adversarial perturbations. Potential directions include watermarking schemes that survive generative transformations, cryptographic approaches, or protection mechanisms that operate at different levels of the content creation and distribution pipeline.

Takeaways

1. Off-the-shelf image-to-image GenAI models can defeat a wide range of image protection schemes through simple prompting, without requiring specialized training or sophisticated attack methods.

2. Current protection mechanisms including Glaze, Mist, PhotoGuard, and Anti-DreamBooth are vulnerable to this generic denoising attack, often performing worse against it than against purpose-built attacks.

3. The attack preserves image utility for adversarial purposes while removing protections, enabling the exact misuse scenarios (style mimicry, deepfakes, unauthorized training) that protections aim to prevent.

4. Many existing image protection schemes provide a false sense of security, as the technical barrier to breaking them has been reduced to using readily available tools accessible to non-experts.

5. Future protection mechanisms must be benchmarked against attacks using off-the-shelf GenAI models as a baseline requirement, and the field needs to explore fundamentally different approaches beyond imperceptible adversarial perturbations.